wb-browser-runtime 0.5.0 → 0.5.1

package/README.md

@@ -29,6 +29,21 @@ Verb arguments support `{{ env.NAME }}` substitution at dispatch time, so any
 secrets your runbook needs (e.g. `HACKERNEWS_PASSWORD`) get pulled from the
 sidecar process env without ever appearing on stdout.
 
+## Optional: anti-detection
+
+Targets behind Cloudflare / Kasada / DataDome (e.g. Airbase) will reject the
+default Browserbase session fingerprint and serve a non-interactive challenge
+page. Flip either flag on for the affected runs.
+
+| Env var                            | Default | Purpose                                          |
+|------------------------------------|---------|--------------------------------------------------|
+| `BROWSERBASE_ADVANCED_STEALTH`     | *(off)* | Send `browserSettings.advancedStealth: true`. Browserbase Scale-plan-gated — API errors on lower plans. |
+| `BROWSERBASE_PROXIES`              | *(off)* | Send `proxies: true`. Routes through Browserbase residential proxy pool. Incurs extra per-session cost. |
+
+Set `=1` (or `=true`) to enable. `proxies: true` alone clears most Cloudflare
+challenges; add `advancedStealth: true` on top when the target still blocks.
+The sidecar logs the resolved config at session create.
+
 ## Optional: session recording (rrweb + CDP screencast)
 
 Each browser session can be recorded two ways and uploaded to a consumer

package/bin/wb-browser-runtime.js

@@ -168,15 +168,35 @@ async function bbCreateSession() {
       "BROWSERBASE_API_KEY and BROWSERBASE_PROJECT_ID must be set",
     );
   }
+
+  // Both flags opt-in per session. advancedStealth is Scale-plan-gated on
+  // Browserbase's side; proxies adds residential-IP cost. Default off so a
+  // misconfigured plan doesn't break unrelated runs (HN, Google Sheets, etc.);
+  // flip per vendor when the target sits behind Cloudflare / similar bot
+  // detection (e.g., Airbase).
+  const envBool = (v) => v === "1" || (typeof v === "string" && v.toLowerCase() === "true");
+  const advancedStealth = envBool(process.env.BROWSERBASE_ADVANCED_STEALTH);
+  const proxies = envBool(process.env.BROWSERBASE_PROXIES);
+
+  // keepAlive:false — slice lifetime is tied to wb process; on shutdown
+  // we explicitly REQUEST_RELEASE so quota isn't burned by orphans.
+  const body = { projectId, keepAlive: false };
+  if (advancedStealth) {
+    body.browserSettings = { advancedStealth: true };
+  }
+  if (proxies) {
+    body.proxies = true;
+  }
+
+  log(`[bb] session create advancedStealth=${advancedStealth} proxies=${proxies}`);
+
   const res = await fetch(`${BB_BASE}/v1/sessions`, {
     method: "POST",
     headers: {
       "X-BB-API-Key": apiKey,
       "Content-Type": "application/json",
     },
-    // keepAlive:false — slice lifetime is tied to wb process; on shutdown
-    // we explicitly REQUEST_RELEASE so quota isn't burned by orphans.
-    body: JSON.stringify({ projectId, keepAlive: false }),
+    body: JSON.stringify(body),
   });
   if (!res.ok) {
     throw new Error(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wb-browser-runtime",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "description": "Browser sidecar runtime for wb — Browserbase + Playwright over the wb-sidecar/1 line-framed JSON protocol.",
   "bin": {
     "wb-browser-runtime": "bin/wb-browser-runtime.js"